Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Want group to enable administrator account but not change its password

16 Oct 2012   #1
loganjones

Windows 7 Professional x64
 
 
Want group to enable administrator account but not change its password

Is this even possible?


My System SpecsSystem Spec
16 Oct 2012   #2
edwar

7 x64
 
 

Sorry, What is it you are asking?
My System SpecsSystem Spec
16 Oct 2012   #3
loganjones

Windows 7 Professional x64
 
 

Custom group whose members are able to activate the deactivated administrator account, but are now allowed to change its password.
My System SpecsSystem Spec
16 Oct 2012   #4
edwar

7 x64
 
 

Don't think so. To enable the Built in Admin account you would need to have a Named Admin account already. If you already have one of those type accounts you can change the password on any account.

Same goes if they had an Admin password even though they were standard users.

If you are going to allow standard users to install software you might as well give them and Admin account.
My System SpecsSystem Spec
16 Oct 2012   #5
loganjones

Windows 7 Professional x64
 
 

Admin account has more privileges than I want most people to have. User account has too few. I generally set my security fairly granularly on my Linux servers, but I'm finding the amount of control I'm given extremely lacking on the Windows servers. Granted 7 isn't a perfect analog to 2008 Server, but I had already registered here before I realized I was on a Windows 7 specific forum and figured it was worth a shot.

The idea is to require administrators to use their accounts to activate the Administrator account and then log in to the administrator account with a different password if they want to affect monitoring, allowing the administrators to administrate but putting another password between them and event logging and such, leaving an extra layer of security in between the administrator's personal account and the true administrator account that has the ability to destroy the audit trail in the event that the less privileged account is compromised.
My System SpecsSystem Spec
16 Oct 2012   #6
edwar

7 x64
 
 

Look into a Power User account. Not normally available in the Control Panel User Accounts but if you open RUN and type Control Userpasswords2 and hit enter you get this screen.

Name:  User Accounts 1.PNG
Views: 1
Size:  24.3 KB

Then highlight the user name and click properties and you get this window.

Name:  User Acount 2.PNG
Views: 1
Size:  17.9 KB

Then go to the Group Membership tab (Pictured) and click the Other section. From there click the drop down arrow and select Power User.


My System SpecsSystem Spec
16 Oct 2012   #7
Alejandro85

Windows 7 Ultimate x64
 
 

What about using UAC to fine control the permissions?

The idea is that all users aren't in the administrator group and therefore with very limited rights in their day to day accounts. When they want to perform administrative task, run the needed programs as administrators (or let the system itself ask for permission) and in the elevation dialog box, you'll be asked for the administrator username and password to get real admin privileges.

EDIT: Have a look at gpedit.msc. In the security section under computer configuration it contains an important number of settings, somewhat hidden, that control many other things about permission and security. Maybe it helps in having a tighter control over permissions.
My System SpecsSystem Spec
Reply

 Want group to enable administrator account but not change its password




Thread Tools





Similar help and support threads
Thread Forum
Built-in Administrator Account - Enable or Disable
How to Enable or Disable the Built-in Elevated Administrator Account in Windows 7 This tutorial will show you how to enable or disable the built-in elevated Administrator account in Windows 7. You must be logged in as an administrator to be able to do the options in this tutorial. ...
Tutorials
How to change Administrator account password
All, I realized today that I do not have access to my system's "Administrator" account though happily I do have admin privileges in another user account. Using "net user administrator" I learned the Administrator account is not active but a password is required to to make any changes....
General Discussion
administrator account/password need to delete / change
i got this computer from someone and i want to delete the other users and the admin..or make me the admin..however i can not do anything because i dont have the password for the adminastrator...i cant get into the bios without a password i cant even do a diskcheck..it just pops up with the name...
General Discussion
how do I enable hidden administrator (not built-in) account on log-on?
Hi Geeks, I tried to hide a standard user account from appearing on log-on screen through registry editor, with help obtained from internet. But i accidentally left a new key (without renaming) in SpecialAccount>UserList. When I switched user, only the standard user account is shown. The...
General Discussion
How to enable Administrator from basic account
Hi, I currently have a Non-Administrator account and so very limited what can be done on the computer (ie cannot install or uninstall software). The hidden Administrator account has been disabled, along with any other account which may have access to perform Administrator commands (even the...
General Discussion
Problem with Enable / Activate Administrator Account
Hi Guys, I tried to enable/activate my administrator account by following these steps: 1. Open the Local Users and Groups manager. 2. In the left pane, click on the Users folder. 3. In the middle pane, right click on Administrator and click on Properties. 4. To Enable the Buit-in...
General Discussion

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 15:58.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App